nzb-search

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a local Bash script (scripts/nzb-api.sh) to perform search and download operations. The script employs a whitelist for its primary operations and correctly handles shell arguments.
  • [CREDENTIALS_UNSAFE]: The skill implements secure credential management by retrieving API keys via the Unix 'pass' utility instead of hardcoding secrets or environment variables.
  • [EXTERNAL_DOWNLOADS]: The skill is designed to download NZB files (XML documents) from the user-configured Usenet indexers. These files are stored locally as requested by the user and are not executed.
  • [PROMPT_INJECTION]: The skill processes and displays external metadata (titles, NFO files) from Usenet indexers. This represents a standard surface for indirect prompt injection common to search tools, but the skill contains no logic to bypass safety guidelines or override agent behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 07:14 AM